Supported Formats

Currently, BOM View supports CycloneDX and SPDX formats in JSON. These can be generated by tools like syft.

Adding SBOMs to Your Site

This application is designed to load SBOMs dynamically at runtime. To add your own SBOMs, you do not need to rebuild the project. Follow these steps in your deployed static site's root directory (e.g., the dist or public folder served by your pages job).

1. Create the sboms directory: If it doesn't already exist, create a directory named sboms.

2. Add Your SBOMs: Copy your CycloneDX/SPDX JSON files into the sboms directory.

3. Update the Index File: Create or update a file named index.json inside the sboms directory. This file tells the application which SBOMs are available. It must contain a single JSON array of strings, where each string is the filename of an SBOM in that directory.

   For example, if you have my-app.json and another-lib.json, the index.json file should look like this:

   root@kitploit:~

   [
     "my-app.json",
     "another-lib.json"
   ]
   

The application will then fetch the index.json to populate the SBOM selection dropdown and load the corresponding file when selected.

Example GitLab Pages CI/CD

Below is an example .gitlab-ci.yml configuration that fetches a pre-built release, extracts SBOMs, and dynamically creates the index.json for deployment.

You can see a live example of this configuration in action here: https://security-dashboard-a9b4f8.gitlab.io/

Required Directory Structure

Your final deployment directory should have the following structure: